gina 0.6.13 → 0.6.14

package/framework/{v0.6.13 → v0.6.14}/core/controller/controller.js

@@ -4249,18 +4249,88 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
     };
 
+    /**
+     * #B399 — own an async app-callback rejection at every query delivery seam.
+     * `query()` delivers outcomes to the app through a Node-style callback (or
+     * the `{onComplete}` facade registering one): a SYNC throw inside that
+     * callback is caught by the success-delivery guards, but an `async`
+     * callback's rejected promise passed through every bare `callback(...)` /
+     * `cb(...)` delivery unowned — no response, the request hung to
+     * client/proxy timeout, and the only trace floated to the process-level
+     * rejection handler (same class as the reserved-action hook half of
+     * #B399). Every app-callback delivery expression is wrapped with this
+     * helper: a thenable return gets a `.catch` routing to the same
+     * `throwError` shape the sync-delivery catches build (flat 500 — parity
+     * with those guards). Sync behaviour at every wrapped site is
+     * byte-unchanged, plain callbacks mint zero promises, and a callback that
+     * already responded before rejecting is absorbed by the #B31
+     * released-response guard (warn + ignore).
+     *
+     * @inner
+     * @param {*} result - the app callback's return value
+     * @returns {*} `result`, unchanged
+     */
+    var _ownAsyncCbRejection = function(result) {
+        if ( result && typeof(result.then) == 'function' ) {
+            result.catch(function(asyncErr) {
+                var infos = local.options, controllerName = infos.controller.substring(infos.controller.lastIndexOf('/'));
+                var msg = 'Controller Query Exception on async callback rejection.\nBundle: '+ infos.bundle +'\nController File: /controllers'+ controllerName +'\nControl: this.'+ infos.control +'(...)\n\r' + ( asyncErr && (asyncErr.stack || asyncErr.message) || String(asyncErr) );
+                var exception = new Error(msg);
+                exception.status = 500;
+                self.throwError(exception);
+            });
+        }
+        return result;
+    };
+
+    /**
+     * Owns a SYNCHRONOUS app-callback throw on a transport-error delivery (#B402).
+     * The error-path deliveries had no try/catch at all: on the event/timer-frame
+     * sites a sync throw escaped to the process handler (lib/proc.js emerg + SIGTERM
+     * -- a whole-bundle kill on both engines for consumer bundles), and on the
+     * caller-frame sites it re-entered the query-scope catch, invoking the app
+     * callback a second time with its own exception. Same exception shape as the
+     * sync-delivery catches, distinct marker, flat 500; the #ERRREF ref and pairing
+     * line are minted inside throwError itself.
+     *
+     * @inner
+     * @param {*} syncErr - whatever the app callback threw
+     * @returns {boolean|undefined} the self.throwError(exception) return value
+     */
+    var _ownSyncCbThrow = function(syncErr) {
+        var infos = local.options, controllerName = infos.controller.substring(infos.controller.lastIndexOf('/'));
+        var msg = 'Controller Query Exception on transport-error callback throw.\nBundle: '+ infos.bundle +'\nController File: /controllers'+ controllerName +'\nControl: this.'+ infos.control +'(...)\n\r' + ( syncErr && (syncErr.stack || syncErr.message) || String(syncErr) );
+        var exception = new Error(msg);
+        exception.status = 500;
+        return self.throwError(exception);
+    };
+
     /**
      * Make an outbound HTTP/HTTPS request from a controller action.
      *
      * Accepts arguments in any of these forms:
      * - `query(options, data, callback)`
      * - `query(options, callback)`
-     * - `query(options, data)` — returns a Promise when the last arg is not a function
+     * - `query(options, data)` — returns a handle exposing `onComplete(cb)`.
+     *   The handle is NOT a thenable — to `await`, promisify the call the way
+     *   the framework does internally:
+     *   `await require('util').promisify(self.query)(options, {})`.
+     *   A non-2xx upstream status rejects the promisified call with the plain
+     *   `{status, error, message}` object; a connection failure rejects with a
+     *   native `Error`.
+     *   `onComplete(cb)` itself delivers err-first (#B404): on failure
+     *   `cb(err)` with `data` undefined — a plain `{status, error}` object for
+     *   a non-2xx status or a transport failure, a native `Error` for a
+     *   pre-transport failure (missing host, unreadable certificate, open
+     *   circuit) — and on success `cb(false, data)`.
+     *
+     * An `async` callback's rejected promise is owned at every delivery seam
+     * (#B399): it answers 500 instead of leaving the request hanging.
      *
      * @param {object}   options          - Request options (host, port, path, method, …)
      * @param {object}   [data]           - Request body / query params
-     * @param {function} [callback]       - `callback(err, result)` — omit to get a Promise
-     * @returns {void|Promise}
+     * @param {function} [callback]       - `callback(err, result)` — omit to get the onComplete handle
+     * @returns {void|object} `undefined` in callback form; the `{onComplete}` handle otherwise
      */
     // replaced: arguments object — use named params (#P23)
     this.query = function(options, data, callback) {
@@ -4333,9 +4403,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         if ( !options.host && !options.hostname ) {
             err = new Error('SuperController::query() needs at least a `host IP` or a `hostname`');
             if (callback) {
-                return callback(err)
+                try {
+                    return _ownAsyncCbRejection(callback(err))
+                } catch (_syncCbErr) {
+                    return _ownSyncCbThrow(_syncCbErr);
+                }
             }
-            self.emit('query#complete', err)
+            // #B404 by-catch — mirror the callback branch's return: without it the
+            // emitter branch fell through and the doomed query kept executing.
+            return self.emit('query#complete', err)
         }
 
 
@@ -4535,7 +4611,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                         return;
                     }
                     if (callback) {
-                        return callback(_cbErr);
+                        try {
+                            return _ownAsyncCbRejection(callback(_cbErr));
+                        } catch (_syncCbErr) {
+                            return _ownSyncCbThrow(_syncCbErr);
+                        }
                     }
                     return self.emit('query#complete', _cbErr);
                 }
@@ -4571,7 +4651,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
         } catch(err) {
             if (callback) {
-                return callback(err)
+                try {
+                    return _ownAsyncCbRejection(callback(err))
+                } catch (_syncCbErr) {
+                    return _ownSyncCbThrow(_syncCbErr);
+                }
             }
             self.emit('query#complete', err)
         }
@@ -4955,7 +5039,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 }
             } catch(err) {
                 if ( typeof(callback) != 'undefined' ) {
-                    return callback(err)
+                    try {
+                        return _ownAsyncCbRejection(callback(err))
+                    } catch (_syncCbErr) {
+                        return _ownSyncCbThrow(_syncCbErr);
+                    }
                 }
 
                 return self.emit('query#complete', err);
@@ -5002,7 +5090,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     };
 
                     if ( typeof(callback) != 'undefined' ) {
-                        return callback(err)
+                        try {
+                            return _ownAsyncCbRejection(callback(err))
+                        } catch (_syncCbErr) {
+                            return _ownSyncCbThrow(_syncCbErr);
+                        }
                     }
 
                     return self.emit('query#complete', err)
@@ -5028,10 +5120,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                             // preventing controllers from implementing graceful degradation (e.g. degraded
                             // mode when a non-critical upstream service fails). Pass the error to the
                             // callback so the caller decides whether to degrade or surface it. (#Q1)
-                            return callback(data);
+                            return _ownAsyncCbRejection(callback(data));
                         }
 
-                        return callback( false, data );
+                        return _ownAsyncCbRejection(callback( false, data ));
                     } catch (e) {
                         var infos = local.options, controllerName = infos.controller.substring(infos.controller.lastIndexOf('/'));
                         var msg = 'Controller Query Exception while catching back.\nBundle: '+ infos.bundle +'\nController File: /controllers'+ controllerName +'\nControl: this.'+ infos.control +'(...)\n\r' + e.stack;
@@ -5099,7 +5191,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             //  - you are trying to query using: `enctype="multipart/form-data"`
             //  -
             if ( typeof(callback) != 'undefined' ) {
-                return callback(err)
+                try {
+                    return _ownAsyncCbRejection(callback(err))
+                } catch (_syncCbErr) {
+                    return _ownSyncCbThrow(_syncCbErr);
+                }
             }
 
             self.emit('query#complete', {
@@ -5138,11 +5234,19 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     }
 
                     try {
+                        // #B404 — error-path emits are single-argument, mirroring the
+                        // callback-form contract (callback(err) on failure, callback(false, data)
+                        // on success): deliver the payload as the error argument. Without this
+                        // guard the dispatch below dereferenced `data.status` with `data`
+                        // undefined and the catch misattributed the TypeError to the app callback.
+                        if ( typeof(data) == 'undefined' ) {
+                            return _ownAsyncCbRejection(cb(err))
+                        }
                         if ( data.status && !/^2/.test(data.status) && typeof(local.options.conf.server.coreConfiguration.statusCodes[data.status]) != 'undefined') {
-                            return cb(data)
+                            return _ownAsyncCbRejection(cb(data))
                         }
 
-                        return cb(err, data)
+                        return _ownAsyncCbRejection(cb(err, data))
                     } catch (e) {
                         var infos = local.options, controllerName = infos.controller.substring(infos.controller.lastIndexOf('/'));
                         var msg = 'Controller Query Exception while catching back.\nBundle: '+ infos.bundle +'\nController File: /controllers'+ controllerName +'\nControl: this.'+ infos.control +'(...)\n\r' + e.stack;
@@ -5275,7 +5379,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 }
             } catch(err) {
                 if ( typeof(callback) != 'undefined' ) {
-                    return callback(err)
+                    try {
+                        return _ownAsyncCbRejection(callback(err))
+                    } catch (_syncCbErr) {
+                        return _ownSyncCbThrow(_syncCbErr);
+                    }
                 }
 
                 return self.emit('query#complete', err);
@@ -5384,17 +5492,25 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                             console.error('[HTTP2] Error while enhancing connect-error message: ' + (_enhErr.stack || _enhErr.message));
                         }
                     }
-                    // local.req/res may be null when the error fires outside a request context
-                    // (background socket event) — log and return instead of crashing
-                    if (!local.req || !local.res) {
-                        console.error('[HTTP2] Session error outside request context — cannot send error response.\n' + (error && (error.stack || error.message) || error));
-                        return;
-                    }
-                    try {
-                        self.throwError(error);
-                    } catch (_throwErr) {
-                        console.error('[HTTP2] self.throwError failed in error handler: ' + (_throwErr.stack || _throwErr.message));
-                    }
+                    // #B403 — the session-level answer is RETIRED: every live stream on a
+                    // failing session self-delivers through its own handlers (request
+                    // 'error' / 'close' / 'end' typed terminals), so this throwError only
+                    // raced the app callback's own response for the SAME failure — and on
+                    // a REUSED session this closure's local/req belong to the CREATING
+                    // query, so it could answer with a stale request's context. Session
+                    // cleanup and the error log above stay; request notification is owned
+                    // by the stream-level deliveries.
+                    // // local.req/res may be null when the error fires outside a request context
+                    // // (background socket event) — log and return instead of crashing
+                    // if (!local.req || !local.res) {
+                    // console.error('[HTTP2] Session error outside request context — cannot send error response.\n' + (error && (error.stack || error.message) || error));
+                    // return;
+                    // }
+                    // try {
+                    // self.throwError(error);
+                    // } catch (_throwErr) {
+                    // console.error('[HTTP2] self.throwError failed in error handler: ' + (_throwErr.stack || _throwErr.message));
+                    // }
                 } catch (_handlerErr) {
                     // Last-resort swallow — throwing from an 'error' listener crashes the
                     // process. Log and return so the session failure stays contained.
@@ -5659,7 +5775,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // H3: if non-critical, swallow and return
             if (_swallowIfNonCritical(_timeoutErr)) return;
             if (typeof callback === 'function') {
-                callback(_timeoutErr);
+                try {
+                    _ownAsyncCbRejection(callback(_timeoutErr));
+                } catch (_syncCbErr) {
+                    _ownSyncCbThrow(_syncCbErr);
+                }
             } else {
                 self.emit('query#complete', { status: 503, error: _timeoutErr });
             }
@@ -5745,7 +5865,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // H3: if non-critical, swallow and return
             if (_swallowIfNonCritical(_ginaErr)) return;
             if (typeof callback !== 'undefined') {
-                callback(_ginaErr);
+                try {
+                    _ownAsyncCbRejection(callback(_ginaErr));
+                } catch (_syncCbErr) {
+                    _ownSyncCbThrow(_syncCbErr);
+                }
             } else {
                 self.emit('query#complete', { status: _ginaStatus, error: _ginaErr });
             }
@@ -5793,7 +5917,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // H3: if non-critical, swallow and return
             if (_swallowIfNonCritical(prematureCloseErr)) return;
             if (typeof callback !== 'undefined') {
-                callback(prematureCloseErr);
+                try {
+                    _ownAsyncCbRejection(callback(prematureCloseErr));
+                } catch (_syncCbErr) {
+                    _ownSyncCbThrow(_syncCbErr);
+                }
             } else {
                 self.emit('query#complete', { status: 503, error: prematureCloseErr });
             }
@@ -5854,7 +5982,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 // H3: if non-critical, swallow and return
                 if (_swallowIfNonCritical(_badGatewayErr)) return;
                 if (typeof callback !== 'undefined') {
-                    callback(_badGatewayErr);
+                    try {
+                        _ownAsyncCbRejection(callback(_badGatewayErr));
+                    } catch (_syncCbErr) {
+                        _ownSyncCbThrow(_syncCbErr);
+                    }
                 } else {
                     self.emit('query#complete', { status: 502, error: _badGatewayErr });
                 }
@@ -5868,7 +6000,14 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // 3. Exception filter for ALPN or protocol mismatches
             if (typeof data === 'string' && /^Unknown ALPN Protocol/.test(data)) {
                 const err = { status: 500, error: new Error(data) };
-                return (typeof callback !== 'undefined') ? callback(err) : self.emit('query#complete', err);
+                if (typeof callback !== 'undefined') {
+                    try {
+                        return _ownAsyncCbRejection(callback(err));
+                    } catch (_syncCbErr) {
+                        return _ownSyncCbThrow(_syncCbErr);
+                    }
+                }
+                return self.emit('query#complete', err);
             }
 
             // 4. Data Parsing & Validation
@@ -5902,12 +6041,19 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     // Error code handling (non-2xx)
                     const statusCodes = local.options.conf.server.coreConfiguration.statusCodes;
                     if (data.status && !/^2/.test(data.status) && typeof statusCodes[data.status] !== 'undefined') {
-                        if (/^5/.test(data.status)) {
-                            return callback(data);
-                        } else {
-                            self.throwError(data);
-                            return;
-                        }
+                        // #B405 — finishing the #Q1 migration on this transport:
+                        // throwError() bypasses the callback, preventing graceful
+                        // degradation, and left a promisified query permanently
+                        // unsettled on any non-5xx status. Every non-2xx now goes
+                        // to the callback so the caller decides — the HTTP/1.1
+                        // contract (see the #Q1 comment there).
+                        // replaced: if (/^5/.test(data.status)) {
+                        // replaced:     (the same wrapped callback(data) delivery — 5xx-only)
+                        // replaced: } else {
+                        // replaced:     self.throwError(data);
+                        // replaced:     return;
+                        // replaced: }
+                        return _ownAsyncCbRejection(callback(data));
                     } else {
                         // Success path
                         if (self && self.isHaltedRequest() && typeof local.onHaltedRequestResumed !== 'undefined') {
@@ -5943,7 +6089,7 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                                 delete data.__ginaFlow;
                             }
                         }
-                        return callback(false, data);
+                        return _ownAsyncCbRejection(callback(false, data));
                     }
                 } catch (e) {
                     const infos = local.options;
@@ -6145,7 +6291,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     code: 'PREFLIGHT_TIMEOUT', retryable: false, status: 503, retryCount: retryCount
                 });
                 if (_swallowIfNonCritical(_pfErr)) return;
-                if (typeof callback === 'function') return callback(_pfErr);
+                if (typeof callback === 'function') {
+                    try {
+                        return _ownAsyncCbRejection(callback(_pfErr));
+                    } catch (_syncCbErr) {
+                        return _ownSyncCbThrow(_syncCbErr);
+                    }
+                }
                 self.emit('query#complete', { status: 503, error: _pfErr });
             }, HTTP2_PREFLIGHT_DEADLINE_MS);
 
@@ -6173,7 +6325,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                         code: 'PREFLIGHT_FAILED', retryable: false, status: 503, retryCount: retryCount
                     });
                     if (_swallowIfNonCritical(_pfErr2)) return;
-                    if (typeof callback === 'function') return callback(_pfErr2);
+                    if (typeof callback === 'function') {
+                        try {
+                            return _ownAsyncCbRejection(callback(_pfErr2));
+                        } catch (_syncCbErr) {
+                            return _ownSyncCbThrow(_syncCbErr);
+                        }
+                    }
                     self.emit('query#complete', { status: 503, error: _pfErr2 });
                     return;
                 }
@@ -6206,8 +6364,16 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     }
 
                     try {
+                        // #B404 — error-path emits are single-argument, mirroring the
+                        // callback-form contract (callback(err) on failure, callback(false, data)
+                        // on success): deliver the payload as the error argument. Without this
+                        // guard the dispatch below dereferenced `data.status` with `data`
+                        // undefined and the catch misattributed the TypeError to the app callback.
+                        if ( typeof(data) == 'undefined' ) {
+                            return _ownAsyncCbRejection(cb(err))
+                        }
                         if ( data.status && !/^2/.test(data.status) && typeof(local.options.conf.server.coreConfiguration.statusCodes[data.status]) != 'undefined') {
-                            cb(data)
+                            _ownAsyncCbRejection(cb(data))
                         } else {
                             // required when control is used in an halted state
                             // Ref.: resumeRequest()
@@ -6215,7 +6381,7 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                                 local.onHaltedRequestResumed(err);
                             }
 
-                            cb(err, data)
+                            _ownAsyncCbRejection(cb(err, data))
                         }
                     } catch (e) {
                         var infos = local.options, controllerName = infos.controller.substring(infos.controller.lastIndexOf('/'));

package/framework/{v0.6.13 → v0.6.14}/core/gna.js

@@ -870,6 +870,20 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
     }
     // get configuration
     gna.getProjectConfiguration( async function onGettingProjectConfig(err, project) {
+    // #B406 — own the WHOLE boot frame. This callback is `async`, so a
+    // synchronous throw anywhere in its direct frame surfaces as a promise
+    // REJECTION, never an exception: the caller's try/catch in
+    // getProjectConfiguration() can never see it, and the process-level
+    // unhandledRejection net above only logs at error level — no `[ emerg`
+    // marker for start.js's startup watchdog (stdout-only, startup-only), no
+    // exit. Pre-fix, a boot-time crash here left the process alive but never
+    // started: the daemon's 60s startup timer was the only terminal, with no
+    // cause attached. The catch below routes every failure in this frame —
+    // sync throws today, any awaited rejection tomorrow — into abort(), the
+    // existing boot terminal (console.emerg + synchronous stderr flush +
+    // exit(1)), whose emerg line is what the watchdog matches on. The body
+    // keeps its original indentation.
+    try {
 
         if (err) {
             console.error(err.stack);
@@ -2343,7 +2357,17 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
             abort(err)
         }
 
-
+    // #B406 — single owned terminal for the whole boot frame (see the header
+    // comment on this callback). abort() reads err.stack through branches that
+    // assume an Error-shaped value, so a non-Error rejection (throw null /
+    // throw 'string') is coerced first — otherwise abort() itself would throw
+    // inside this catch and the rejection would escape back to the silent net.
+    } catch (bootErr) {
+        if ( !(bootErr instanceof Error) ) {
+            bootErr = new Error('boot frame rejected with a non-Error value: ' + String(bootErr));
+        }
+        abort(bootErr);
+    }
     });//EO onDoneGettingProjectConfiguration.
 });
 

package/framework/{v0.6.13 → v0.6.14}/core/server.js

@@ -6271,6 +6271,56 @@ function Server(options) {
 
 
         var bodyStr = null, obj = null, exception = null;
+
+        /**
+         * Serializes `request.query` for the GET/HEAD re-parse below,
+         * unwrapping nested-JSON STRING values by PARSING them (#B407).
+         *
+         * A query value may legitimately arrive as serialized JSON — a
+         * `?filter={"a":1}` reaches the engine query parser as the STRING
+         * value `'{"a":1}'` — and the pipeline below expects it to land as
+         * a real object. The previous implementation unwrapped TEXTUALLY on
+         * the serialized document: two wrapper replaces for the quotes
+         * around a `{`-leading value, then a blanket backslash strip to
+         * clean the escapes INSIDE the unwrapped object. That strip ran
+         * over the WHOLE document, destroying the escapes JSON.stringify
+         * had just written for ORDINARY values: a newline (`%0A`) became
+         * the letter `n`, a tab the letter `t`, a backslash vanished — and
+         * a double quote in a value (or a JSON-ARRAY value, which the
+         * wrapper replaces never handled) produced invalid JSON, which
+         * `parseBody` reports (`[365] could not parse body`) before
+         * returning undefined, so EVERY query param on the request was
+         * silently dropped. Parsing each candidate value keeps the unwrap
+         * intent — validated now, and correct for nested content carrying
+         * escapes, which the textual unwrap also corrupted — while every
+         * escape in an ordinary value survives serialization intact.
+         *
+         * Only own enumerable STRING values leaning `{`/`[` are candidates;
+         * one that does not parse stays a verbatim string (previously that
+         * shape, once the strip mangled it, also dropped the whole query).
+         * The `"true"`/`"false"`/`"on"`/`"null"` text coercion at the call
+         * sites is unchanged — with escapes intact it can only match
+         * whole-string values, never an escaped occurrence inside one.
+         *
+         * @inner
+         * @private
+         * @param {object} query - The engine-parsed `request.query`
+         * @returns {string} Serialized query, nested-JSON string values unwrapped
+         */
+        var serializeQueryForReparse = function (query) {
+            for (var qKey in query) {
+                if ( !Object.prototype.hasOwnProperty.call(query, qKey) ) continue;
+                if ( typeof(query[qKey]) == 'string' && /^\s*[\{\[]/.test(query[qKey]) ) {
+                    try {
+                        query[qKey] = JSON.parse(query[qKey]);
+                    } catch (qParseErr) {
+                        // not JSON after all — keep the raw string value
+                    }
+                }
+            }
+            return JSON.stringify(query);
+        };
+
         // to compare with /core/controller/controller.js -> getParams()
         switch( request.method.toLowerCase() ) {
             case 'post':
@@ -6439,7 +6489,11 @@ function Server(options) {
 
                     }
 
-                    bodyStr = JSON.stringify(request.query).replace(/\"{/g, '{').replace(/}\"/g, '}').replace(/\\/g, '');
+                    // #B407 — was: bodyStr = JSON.stringify(request.query).replace(/\"{/g, '{').replace(/}\"/g, '}').replace(/\\/g, '');
+                    // (see serializeQueryForReparse above: the textual unwrap's blanket backslash
+                    // strip corrupted every escape-bearing value and dropped the whole query on a
+                    // double quote or a JSON-array value)
+                    bodyStr = serializeQueryForReparse(request.query);
                     // false & true case
                     if ( /(\"false\"|\"true\"|\"on\")/i.test(bodyStr) )
                         bodyStr = bodyStr.replace(/\"false\"/ig, false).replace(/\"true\"/ig, true).replace(/\"on\"/ig, true);
@@ -6709,7 +6763,11 @@ function Server(options) {
                         }
                         delete request.query.inheritedData;
                     }
-                    bodyStr = JSON.stringify(request.query).replace(/\"{/g, '{').replace(/}\"/g, '}').replace(/\\/g, '');
+                    // #B407 — was: bodyStr = JSON.stringify(request.query).replace(/\"{/g, '{').replace(/}\"/g, '}').replace(/\\/g, '');
+                    // (see serializeQueryForReparse above: the textual unwrap's blanket backslash
+                    // strip corrupted every escape-bearing value and dropped the whole query on a
+                    // double quote or a JSON-array value)
+                    bodyStr = serializeQueryForReparse(request.query);
                     if ( /(\"false\"|\"true\"|\"on\")/i.test(bodyStr) )
                         bodyStr = bodyStr.replace(/\"false\"/ig, false).replace(/\"true\"/ig, true).replace(/\"on\"/ig, true);
                     if ( /(\"null\")/i.test(bodyStr) )
@@ -6880,6 +6938,12 @@ function Server(options) {
         ;
 
         //Reloading assets & files.
+        // ⚠️ Before ever uncommenting the refresh below, settle secrets-backend
+        // caching: `secrets.resolve` runs inside every config load, so with
+        // `settings.secrets.exec` declared this dead branch would re-run the
+        // operator's fetch command — a blocking child process — PER BUNDLE PER
+        // REQUEST in cacheless mode. Today the exec fetch runs once per bundle
+        // at boot only, precisely because this call site is dead.
         // if (!isCacheless) { // all but dev & debug
             callback(err, bundle, pathname, options.config, req, res, next)
         // } else {